kevmap

Techniques › T1070 › T1070.006

T1070.006 Timestomp

stealth — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
4
analytics
6
Sigma rules tagged attack.t1070.006
0
KEV CVEs mapped here
<p>Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.</p><p>In Windows systems, both the $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes record times in a Master File Table (MFT) file. $SI (dates/time stamps) is displayed to the end user, including in the File System view, while $FN is dealt with by the kernel.</p><p>Modifying the $SI attribute is the most common method of timestomping because it can be modified at the user level using API calls. $FN timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.</p><p>Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the $SI and $FN attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.</p><p>In Linux systems and on ESXi servers, threat actors may attempt to perform timestomping using commands such as touch -a -m -t <timestamp> <filename> (which sets access and modification times to a specific value) or touch -r <filename> <filename> (which sets access and modification times to match those of another file).</p><p>Timestomping may be used along with file name Masquerading to hide malware and tools.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1070.006

Touch Suspicious Service File mediumtest
Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-01-11 · logsource: product=linux category=process_creation · 31545105-3444-4584-bebf-c466353230d2
Detects usage of the "touch" process in service file.
Techniques: T1070.006
File Creation Date Changed to Another Year lowtest
Author: frack113, Florian Roth (Nextron Systems) · 2022-08-12 (modified 2026-01-20) · logsource: product=windows category=file_change · 558eebe5-f2ba-4104-b339-36f7902bcc1a
Detects when the file creation time is changed to a year before 2020. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity. In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly. Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories. Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.
Techniques: T1070.006
File Time Attribute Change mediumtest
Author: Igor Fits, Mikhail Larin, oscd.community · 2020-10-19 (modified 2022-01-12) · logsource: product=macos category=process_creation · 88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0
Detect file time attribute change to hide new or changes to existing files
Techniques: T1070.006
File Time Attribute Change - Linux mediumtest
Author: Igor Fits, oscd.community · 2020-10-15 (modified 2022-11-28) · logsource: product=linux service=auditd · b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b
Detect file time attribute change to hide new or changes to existing files.
Techniques: T1070.006
Powershell Timestomp mediumtest
Author: frack113 · 2021-08-03 (modified 2022-12-25) · logsource: product=windows category=ps_script · c6438007-e081-42ce-9483-b067fbef33c3
Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.
Techniques: T1070.006
Unauthorized System Time Modification lowtest
Author: @neu5ron · 2019-02-05 (modified 2025-12-03) · logsource: product=windows service=security · faa031b5-21ed-4e02-8881-2591f98d82ed
Detect scenarios where a potentially unauthorized application or user is modifying the system time.
Techniques: T1070.006

Rules tagged at the parent level (attack.t1070) 20

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

IIS WebServer Log Deletion via CommandLine Utilities mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-02 · logsource: product=windows category=process_creation · 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Techniques: T1070
Terminal Server Client Connection History Cleared - Registry hightest
Author: Christian Burkard (Nextron Systems) · 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
Detects the deletion of registry keys containing the MSTSC connection history
Techniques: T1070T1112
Remove Exported Mailbox from Exchange Webserver hightest
Author: Christian Burkard (Nextron Systems) · 2021-08-27 (modified 2023-01-23) · logsource: product=windows service=msexchange-management · 09570ae5-889e-43ea-aac0-0e1221fb3d95
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Techniques: T1070
Disable of ETW Trace - Powershell hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-28 (modified 2022-11-25) · logsource: product=windows category=ps_script · 115fdba9-f017-42e6-84cf-d5573bf2ddf8
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Techniques: T1070T1685
SES Identity Has Been Deleted mediumtest
Author: Janantha Marasinghe · 2022-12-13 (modified 2022-12-28) · logsource: product=aws service=cloudtrail · 20f754db-d025-4a8f-9d74-e0037e999a9a
Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
Techniques: T1070
Tomcat WebServer Logs Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-16 · logsource: product=windows category=file_delete · 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Kubernetes Events Deleted mediumtest
Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · 3132570d-cab2-4561-9ea6-1743644b2290
Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
Techniques: T1070
IIS WebServer Access Logs Deleted mediumtest
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-09-16 (modified 2023-02-15) · logsource: product=windows category=file_delete · 3eb8c339-a765-48cc-a150-4364c04652bf
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Filter Driver Unloaded Via Fltmc.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-13 (modified 2025-10-07) · logsource: product=windows category=process_creation · 4931188c-178e-4ee7-a348-39e8a7a56821
Detect filter driver unloading activity via fltmc.exe
Techniques: T1070T1685T1685.001
Sysmon Driver Unloaded Via Fltmc.EXE hightest
Author: Kirill Kiryanov, oscd.community · 2019-10-23 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4d7cda18-1b12-4e52-b45c-d28653210df8
Detects possible Sysmon filter driver unloaded via fltmc.exe
Techniques: T1070T1685T1685.001
EventLog EVTX File Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 · logsource: product=windows category=file_delete · 63c779ba-f638-40a0-a593-ddd45e8b1ddc
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Linux Package Uninstall lowtest
Author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) · 2023-03-09 · logsource: product=linux category=process_creation · 95d61234-7f56-465c-6f2d-b562c6fedbc4
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".
Techniques: T1070
DLL Load By System Process From Suspicious Locations mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-07-17 (modified 2023-09-18) · logsource: product=windows category=image_load · 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Techniques: T1070
ETW Trace Evasion Activity hightest
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2019-03-22 (modified 2022-06-28) · logsource: product=windows category=process_creation · a238b5d0-ce2d-4414-a676-7a531b3d13d6
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Techniques: T1070T1685
Exchange PowerShell Cmdlet History Deleted hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-26 (modified 2022-12-30) · logsource: product=windows category=file_delete · a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070
Fsutil Suspicious Invocation highstable
Author: Ecco, E.M. Anhaus, oscd.community · 2019-09-26 (modified 2023-09-09) · logsource: product=windows category=process_creation · add64136-62e5-48ea-807e-88638d02df1e
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).
Techniques: T1070T1485
Clearing Windows Console History hightest
Author: Austin Songer @austinsonger · 2021-11-25 (modified 2022-12-25) · logsource: product=windows category=ps_script · bde47d4b-9987-405c-94c7-b080410e8ea7
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Techniques: T1070T1070.003
Shadow Copies Deletion Using Operating Systems Utilities highstable
Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) · 2019-10-22 (modified 2022-11-03) · logsource: product=windows category=process_creation · c947b146-0abc-4c87-9c64-b17e9d7274a2
Shadow Copies deletion using operating systems utilities
Techniques: T1070T1490
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE mediumtest
Author: @neu5ron · 2019-02-07 (modified 2023-02-15) · logsource: product=windows category=process_creation · c9fbe8e9-119d-40a6-9b59-dd58a5d84429
Detects potential malicious and unauthorized usage of bcdedit.exe
Techniques: T1070T1542.003
PowerShell Console History Logs Deleted mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 · logsource: product=windows category=file_delete · ff301988-c231-4bd0-834c-ac9d73b86586
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence
Techniques: T1070